Skip to main content

Use of software with known vulnerabilities in environments

Need​

Updating software and dependencies to versions without known vulnerabilities

Context​

  • Usage of Dart for building cross-platform mobile, web, and desktop applications
  • Usage of Shelf for managing and organizing data in a Node.js application
  • Usage of shelf_io for managing and interacting with data storage in Node.js applications

Description​

Non compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}

The above code is a simple server using the shelf framework in Dart. It imports the shelf and shelf_io libraries and sets up a simple server that echoes back the request URL.

The vulnerability here lies in the use of a potentially outdated version of the shelf library. Using software or dependencies with known vulnerabilities can expose your application to various types of attacks. If the version of shelf used in this application has known vulnerabilities, it could potentially allow an attacker to exploit these vulnerabilities to conduct attacks such as Denial of Service (DoS), Remote Code Execution (RCE), or even data breaches.

To mitigate this, it is recommended to always use the latest version of your dependencies and regularly check for and update any outdated dependencies. This can be done manually by checking the official Dart package site (https://pub.dev/) for the latest versions of your dependencies, or automatically using a dependency check tool.

Remember, keeping your dependencies up-to-date is a crucial part of maintaining the security of your application.

Steps​

  • Identify the version of the 'shelf' package being used in the project.
  • Check if there are any known vulnerabilities associated with the current version of the 'shelf' package.
  • If there are known vulnerabilities, look for the latest stable version of the 'shelf' package that has addressed these vulnerabilities.
  • Update the 'shelf' package to the latest stable version that has fixed the known vulnerabilities.
  • Test the application thoroughly to ensure that the update does not break any existing functionality.
  • Regularly update the 'shelf' package to its latest stable version to prevent the use of software with known vulnerabilities.

Compliant code​

import 'package:shelf/shelf.dart' as shelf;
import 'package:shelf/shelf_io.dart' as io;

void main() {
  var handler = const shelf.Pipeline().addMiddleware(shelf.logRequests())
      .addHandler(_echoRequest);

  io.serve(handler, 'localhost', 8080);
}

shelf.Response _echoRequest(shelf.Request request) {
  return shelf.Response.ok('Request for "${request.url}"');
}

The above code is a simple backend application written in Dart using the Shelf framework. The application creates a server that listens on localhost at port 8080 and responds with a simple message echoing the requested URL.

However, the code has a potential vulnerability if the version of the 'shelf' package being used has known vulnerabilities. Using software with known vulnerabilities can expose the application to potential security risks.

To fix this vulnerability, follow these steps:

  1. Identify the version of the 'shelf' package being used in the project. You can do this by checking the pubspec.yaml file in your Dart project.

  2. Check if there are any known vulnerabilities associated with the current version of the 'shelf' package. You can do this by visiting the Dart packages site and checking the 'versions' tab for any version warnings.

  3. If there are known vulnerabilities, look for the latest stable version of the 'shelf' package that has addressed these vulnerabilities. This information can also be found on the Dart packages site.

  4. Update the 'shelf' package to the latest stable version that has fixed the known vulnerabilities. You can do this by updating the version number in your pubspec.yaml file and running pub get to fetch the updated package.

  5. Test the application thoroughly to ensure that the update does not break any existing functionality. This can involve running your existing test suite, manually testing the application, or using automated testing tools.

  6. Regularly update the 'shelf' package to its latest stable version to prevent the use of software with known vulnerabilities. This can be part of a regular maintenance schedule for your application.

By following these steps, you can ensure that your application is not using software with known vulnerabilities, thereby reducing the potential security risks.

References​

Last updated on